Labstack Echo 4.8.0 - Open Redirect

Labstack Echo 4.8.0 contains an open redirect vulnerability via the Static Handler component. An attacker can leverage this vulnerability to cause server-side request forgery, making it possible to obtain sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2022-400...

ROOT-APP-GOBINARY-GHSA-9969-6676-49H5 GHSA-9969-6676-49h5 in github.com/labstack/echo/v4 - Patched by Root

Root has patched GHSA-9969-6676-49h5 in the github.com/labstack/echo/v4 package for Root:Go. Multiple fixed versions available...

ROOT-APP-GOBINARY-GHSA-F48P-C9V4-H7XV GHSA-f48p-c9v4-h7xv in github.com/labstack/echo/v4 - Patched by Root

Root has patched GHSA-f48p-c9v4-h7xv in the github.com/labstack/echo/v4 package for Root:Go. Multiple fixed versions available...

ROOT-APP-GOBINARY-GHSA-H7WR-284F-5QVC GHSA-h7wr-284f-5qvc in github.com/labstack/echo/v4 - Patched by Root

Root has patched GHSA-h7wr-284f-5qvc in the github.com/labstack/echo/v4 package for Root:Go. Multiple fixed versions available...

ROOT-APP-GOBINARY-GHSA-CXF3-9H37-7RR8 GHSA-cxf3-9h37-7rr8 in github.com/labstack/echo/v4 - Patched by Root

Root has patched GHSA-cxf3-9h37-7rr8 in the github.com/labstack/echo/v4 package for Root:Go. Multiple fixed versions available...

Reliance on Untrusted Inputs in a Security Decision

Overview Affected versions of this package are vulnerable to Reliance on Untrusted Inputs in a Security Decision via the Context.RealIP method in context.go. When EchoIPExtractor is unset, the default RateLimiter uses ctx.RealIP as its client identifier, and an attacker can evade throttling by...

Reliance on Untrusted Inputs in a Security Decision

Overview Affected versions of this package are vulnerable to Reliance on Untrusted Inputs in a Security Decision via the Context.RealIP method in context.go. When EchoIPExtractor is unset, the default RateLimiter uses ctx.RealIP as its client identifier, and an attacker can evade throttling by...

Open Redirect

Overview Affected versions of this package are vulnerable to Open Redirect via the sanitizeURI function in the trailing-slash middleware and static directory redirects. An attacker can request a path such as /%09/attacker.example/x/; when a redirect is generated, the decoded tab between the slash...

Open Redirect

Overview github.com/labstack/echo/v5/middleware is a middleware package for echo. Affected versions of this package are vulnerable to Open Redirect via the sanitizeURI function in the trailing-slash middleware and static directory redirects. An attacker can request a path such as...

Open Redirect

Overview Affected versions of this package are vulnerable to Open Redirect via the sanitizeURI function in the trailing-slash middleware and static directory redirects. An attacker can request a path such as /%09/attacker.example/x/; when a redirect is generated, the decoded tab between the slash...

Reliance on Untrusted Inputs in a Security Decision

Overview github.com/labstack/echo/v4/middleware is a middleware package for echo. Affected versions of this package are vulnerable to Reliance on Untrusted Inputs in a Security Decision via the Context.Scheme method in Echo’s request context. A remote unauthenticated attacker can send...

Open Redirect

Overview github.com/labstack/echo/v4/middleware is a middleware package for echo. Affected versions of this package are vulnerable to Open Redirect via the sanitizeURI function in the trailing-slash middleware and static directory redirects. An attacker can request a path such as...

Reliance on Untrusted Inputs in a Security Decision

Overview github.com/labstack/echo/v5/middleware is a middleware package for echo. Affected versions of this package are vulnerable to Reliance on Untrusted Inputs in a Security Decision via the Context.Scheme method in Echo’s request context. A remote unauthenticated attacker can send...

Open Redirect

Overview Affected versions of this package are vulnerable to Open Redirect via the Scheme method in the Context component. An attacker can cause WWWRedirect, NonWWWRedirect, and their WithConfig variants to place an attacker-chosen URI scheme in the Location header by sending a request with a...

Open Redirect

Overview Affected versions of this package are vulnerable to Open Redirect via the Scheme method in the Context component. An attacker can cause WWWRedirect, NonWWWRedirect, and their WithConfig variants to place an attacker-chosen URI scheme in the Location header by sending a request with a...

Use of Less Trusted Source

Overview github.com/labstack/echo/v5/middleware is a middleware package for echo. Affected versions of this package are vulnerable to Use of Less Trusted Source via the ExtractIPFromRealIPHeader function in ip.go. With the extractor’s default trust options, an attacker can make c.RealIP return a...

Unchecked Return Value

Overview github.com/labstack/echo/v5/middleware is a middleware package for echo. Affected versions of this package are vulnerable to Unchecked Return Value via the BodyDump middleware in middleware/bodydump.go. An attacker can cause a handler to accept a truncated request despite the configured...

Unchecked Return Value

Overview github.com/labstack/echo/v4/middleware is a middleware package for echo. Affected versions of this package are vulnerable to Unchecked Return Value via the BodyDump middleware in middleware/bodydump.go. An attacker can cause a handler to accept a truncated request despite the configured...

Use of Non-Canonical URL Paths for Authorization Decisions

Overview github.com/labstack/echo/v5/middleware is a middleware package for echo. Affected versions of this package are vulnerable to Use of Non-Canonical URL Paths for Authorization Decisions via the Static middleware in middleware/static.go. When Static is attached to a catch-all route alongsid...

Use of Non-Canonical URL Paths for Authorization Decisions

Overview github.com/labstack/echo/v4/middleware is a middleware package for echo. Affected versions of this package are vulnerable to Use of Non-Canonical URL Paths for Authorization Decisions via the Static middleware in middleware/static.go. When Static is attached to a catch-all route alongsid...